test: tighten permissions

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
           nix_version: 2.31.2
       - uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1
       - run: deno task build
-      - run: deno test --allow-read
+      - run: deno test -P
   typecheck:
     name: Check TypeScript
     runs-on: ubuntu-24.04

deno.json

@@ -14,7 +14,11 @@
     "exclude": ["!src/main.wasm", "!src/wasm_exec.js"]
   },
   "tasks": {
-    "build": "deno run --allow-env --allow-read --allow-run --allow-write build.ts",
-    "test": "deno test --allow-read"
+    "build": "deno run --allow-env --allow-read --allow-run --allow-write build.ts"
+  },
+  "test": {
+    "permissions": {
+      "read": ["src/main.wasm", "tests/publiccode.yml"]
+    }
   }
 }

tests/mod_test.ts

@@ -5,8 +5,7 @@ import { initializeWasm, validator } from "../src/validator.ts";
 await initializeWasm();
 
 Deno.test("Simple test", async () => {
-  const path = new URL("./publiccode.yml", import.meta.url);
-  const publicCodeYaml = await Deno.readTextFile(path);
+  const publicCodeYaml = await Deno.readTextFile("tests/publiccode.yml");
 
   const res = await validator({ publiccode: publicCodeYaml });